CVE-2025-68264

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-68264
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-68264.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-68264
Downstream
Related
Published
2025-12-16T14:45:06Z
Modified
2026-08-12T03:30:08Z
Summary
ext4: refresh inline data size before write operations
Details

In the Linux kernel, the following vulnerability has been resolved:

ext4: refresh inline data size before write operations

The cached ei->i_inline_size can become stale between the initial size check and when ext4_update_inline_data()/ext4_create_inline_data() use it. Although ext4_get_max_inline_size() reads the correct value at the time of the check, concurrent xattr operations can modify i_inline_size before ext4_write_lock_xattr() is acquired.

This causes ext4_update_inline_data() and ext4_create_inline_data() to work with stale capacity values, leading to a BUG_ON() crash in ext4_write_inline_data():

kernel BUG at fs/ext4/inline.c:1331! BUG_ON(pos + len > EXT4_I(inode)->i_inline_size);

The race window:

  1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct)
  2. Size check passes for 50-byte write
  3. [Another thread adds xattr, i_inline_size changes to 40]
  4. ext4_write_lock_xattr() acquires lock
  5. ext4_update_inline_data() uses stale i_inline_size = 60
  6. Attempts to write 50 bytes but only 40 bytes actually available
  7. BUG_ON() triggers

Fix this by recalculating i_inline_size via ext4_find_inline_data_nolock() immediately after acquiring xattr_sem. This ensures ext4_update_inline_data() and ext4_create_inline_data() work with current values that are protected from concurrent modifications.

This is similar to commit a54c4613dac1 ("ext4: fix race writing to an inline_data file while its xattrs are changing") which fixed i_inline_off staleness. This patch addresses the related i_inline_size staleness issue.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68264.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
67cf5b09a46f72e048501b84996f2f77bc42e947
Fixed
54ab81ae5f218452e64470cd8a8139bb5880fe2b
Fixed
43bf001f0fe4e59bba47c897505222f959f4a1cc
Fixed
89c2c41f0974e530b2d032c3695095aa0559adb1
Fixed
1687a055a555347b002f406676a1aaae4668f242
Fixed
210ac60a86a3ad2c76ae60e0dc71c34af6e7ea0b
Fixed
ca43ea29b4c4d2764aec8a26cffcfb677a871e6e
Fixed
58df743faf21ceb1880f930aa5dd428e2a5e415d
Fixed
892e1cf17555735e9d021ab036c36bc7b58b0e3b

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-68264.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.8.0
Fixed
5.10.248
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.198
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.160
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.120
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.62
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.17.12
Type
ECOSYSTEM
Events
Introduced
6.18.0
Fixed
6.18.1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-68264.json"